slicetest 0.7.0 → 0.9.0

package/dist/init.js

@@ -74,6 +74,37 @@ function runnable(dir) {
         return false;
     }
 }
+/** Where plain SQL migrations usually live (golang-migrate, goose, sqlx, Diesel, dbmate). */
+const SQL_MIGRATION_DIRS = ["migrations", "db/migrations", "sql/migrations", "database/migrations"];
+/** `.sql` files, or Diesel's directories with an `up.sql`. */
+function hasSqlMigrations(dir) {
+    if (!existsSync(dir))
+        return false;
+    return readdirSync(dir, { withFileTypes: true }).some((e) => (e.isFile() && e.name.endsWith(".sql")) || (e.isDirectory() && existsSync(path.join(dir, e.name, "up.sql"))));
+}
+/**
+ * The Go package to run: `.` when the root is package main, else the one command in `cmd/*`
+ * (or the one named server, api, app, web or like the module). Undefined when there is none.
+ */
+function goMain(root, goMod) {
+    const isMain = (dir) => {
+        try {
+            return readdirSync(dir).some((f) => f.endsWith(".go") && !f.endsWith("_test.go") && /^\s*package\s+main\b/m.test(readFileSync(path.join(dir, f), "utf8")));
+        }
+        catch {
+            return false;
+        }
+    };
+    if (isMain(root))
+        return ".";
+    const cmd = path.join(root, "cmd");
+    if (!existsSync(cmd))
+        return undefined;
+    const mains = readdirSync(cmd, { withFileTypes: true }).filter((e) => e.isDirectory() && isMain(path.join(cmd, e.name))).map((e) => e.name).sort();
+    const module = /^module\s+(\S+)/m.exec(goMod)?.[1]?.split("/").pop();
+    const pick = mains.length === 1 ? mains[0] : ["server", "api", "app", "web", "http", module].find((n) => n && mains.includes(n));
+    return pick ? `./cmd/${pick}` : undefined;
+}
 export async function detect(root) {
     const notes = [];
     // The app may live in a subdirectory (backend/, server/, …); everything about the app is read there.
@@ -238,19 +269,33 @@ export async function detect(root) {
         }
     }
     else if (has("go.mod")) {
-        command = "go run .";
-        notes.push("app: Go (go.mod). It must listen on $PORT.");
+        const main = goMain(appRoot, await read("go.mod"));
+        // Built once up front, so the workers' `go run` find everything compiled instead of compiling at once.
+        build = "go build ./...";
+        command = `go run ${main ?? "."}`;
+        readyTimeout = 60_000;
+        notes.push(main && main !== "."
+            ? `app: Go (go.mod), the main package in ${main.slice(2)}/. It must listen on $PORT.`
+            : main
+                ? "app: Go (go.mod). It must listen on $PORT."
+                : "app: Go (go.mod), but no main package at the root or in cmd/*/: set the package in app.command (`go run ./cmd/server`). It must listen on $PORT.");
     }
     else if (has("Cargo.toml")) {
-        command = "cargo run";
-        notes.push("app: Rust (Cargo.toml). It must listen on $PORT.");
+        const cargo = await read("Cargo.toml");
+        // Compiled once before the workers start; `cargo run` then only checks that nothing changed.
+        build = "cargo build -q";
+        command = "cargo run -q";
+        readyTimeout = 120_000;
+        notes.push(/^\[workspace\]/m.test(cargo) && !/^\[package\]/m.test(cargo)
+            ? "app: Rust workspace (Cargo.toml): add `-p <crate>` to app.command for the server's crate. It must listen on $PORT."
+            : "app: Rust (Cargo.toml), built once with `cargo build`. It must listen on $PORT.");
     }
     else {
         notes.push("app: couldn't tell how to start the app. Set app.command.");
     }
     // --- migrations ---
     let migrate;
-    const migrationsSql = has("migrations") && (await readdir(path.join(appRoot, "migrations"))).some((f) => f.endsWith(".sql"));
+    const migrationsDir = SQL_MIGRATION_DIRS.find((d) => hasSqlMigrations(path.join(appRoot, d)));
     const atlas = await findAtlas(root, appDir);
     if (atlas) {
         migrate = { atlas: { dir: `file://${atlas}` } };
@@ -304,9 +349,9 @@ export async function detect(root) {
         migrate = { command: "npx knex migrate:latest", inputs: ["migrations"] };
         notes.push("db: Knex migrations");
     }
-    else if (migrationsSql) {
-        migrate = { sql: "migrations" };
-        notes.push("db: plain SQL files in migrations/, applied in name order");
+    else if (migrationsDir) {
+        migrate = { sql: migrationsDir };
+        notes.push(`db: SQL migrations in ${migrationsDir}/, applied in version order (down migrations left out)`);
     }
     else if (has("schema.sql")) {
         migrate = { sql: "schema.sql" };

package/dist/list.d.ts

@@ -0,0 +1,26 @@
+export interface ListedScenario {
+    file: string;
+    line: number;
+    name: string;
+    tags: string[];
+    /** `skip`, `only`, or what `--tag` / `-t` leave out. */
+    status: "run" | "skip" | "only" | "filtered";
+    /** Rows of `each`: the scenario runs once per row. */
+    rows: number;
+    steps: number;
+}
+/**
+ * The YAML scenarios under `root`, without starting anything: for a quick look at what a run
+ * would do, which `--tag` / `-t` select, and for tools (`--json`). Files that don't parse are
+ * reported in `errors` with their line, as a run would report them.
+ */
+export declare function listScenarios(root: string, opts?: {
+    filters?: string[];
+    name?: string;
+    tags?: string;
+}): Promise<{
+    scenarios: ListedScenario[];
+    errors: string[];
+}>;
+/** One line per scenario, grouped by file. */
+export declare function formatList({ scenarios, errors }: Awaited<ReturnType<typeof listScenarios>>): string;

package/dist/list.js

@@ -0,0 +1,71 @@
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { tagsSelected } from "./scenario.js";
+import { parseScenarioFile } from "./yaml.js";
+const SKIP_DIRS = new Set(["node_modules", ".git", "dist", "build", "target", "vendor", ".venv", "venv"]);
+async function scenarioFiles(dir, out = []) {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith("."))
+                await scenarioFiles(path.join(dir, entry.name), out);
+        }
+        else if (/\.scenario\.ya?ml$/.test(entry.name))
+            out.push(path.join(dir, entry.name));
+    }
+    return out.sort();
+}
+/**
+ * The YAML scenarios under `root`, without starting anything: for a quick look at what a run
+ * would do, which `--tag` / `-t` select, and for tools (`--json`). Files that don't parse are
+ * reported in `errors` with their line, as a run would report them.
+ */
+export async function listScenarios(root, opts = {}) {
+    const scenarios = [];
+    const errors = [];
+    const pattern = opts.name ? new RegExp(opts.name) : undefined;
+    for (const file of await scenarioFiles(root)) {
+        const rel = path.relative(root, file).split(path.sep).join("/");
+        if (opts.filters?.length && !opts.filters.some((f) => rel.includes(f)))
+            continue;
+        try {
+            const doc = parseScenarioFile(await readFile(file, "utf8"), rel);
+            for (const sc of doc.scenarios) {
+                const tags = sc.tags ?? [];
+                const selected = tagsSelected(tags, opts.tags) && (!pattern || pattern.test(sc.name));
+                scenarios.push({
+                    file: rel,
+                    line: sc.line,
+                    name: sc.name,
+                    tags,
+                    status: sc.skip ? "skip" : !selected ? "filtered" : sc.only ? "only" : "run",
+                    rows: sc.each?.length ?? 1,
+                    steps: doc.setup.length + sc.steps.length,
+                });
+            }
+        }
+        catch (e) {
+            errors.push(e.message);
+        }
+    }
+    return { scenarios, errors };
+}
+/** One line per scenario, grouped by file. */
+export function formatList({ scenarios, errors }) {
+    const lines = [];
+    let file = "";
+    for (const s of scenarios) {
+        if (s.file !== file) {
+            file = s.file;
+            lines.push(file);
+        }
+        const mark = { run: "  ", only: "▶ ", skip: "- ", filtered: "· " }[s.status];
+        const rows = s.rows > 1 ? ` ×${s.rows}` : "";
+        const tags = s.tags.length ? `  [${s.tags.join(", ")}]` : "";
+        lines.push(`  ${mark}${s.name}${rows}${tags}  (line ${s.line}, ${s.steps} steps)`);
+    }
+    const runs = scenarios.filter((s) => s.status === "run" || s.status === "only").reduce((n, s) => n + s.rows, 0);
+    lines.push("", `${scenarios.length} scenario(s) in ${new Set(scenarios.map((s) => s.file)).size} file(s); ${runs} run(s) selected.`);
+    if (errors.length)
+        lines.push("", "Files with mistakes:", ...errors.map((e) => `  ${e.split("\n")[0]}`));
+    return `${lines.join("\n")}\n`;
+}

package/dist/matchers.d.ts

@@ -1,11 +1,18 @@
 import { type Where } from "./db.js";
-import type { HttpResponse } from "./http.js";
+import { type HttpResponse } from "./http.js";
 import { type MatchOptions } from "./stub.js";
+/** One expected call for `toHaveReceivedInOrder`: `[stub, method, path, match?]`. */
+export type OrderedCall = [stub: string, method: string, path: string | RegExp, match?: MatchOptions];
 interface SlicetestMatchers<R = unknown> {
     /** The stub received at least one call matching `method path` (and `match`, if given). */
     toHaveReceived(method: string, path: string | RegExp, match?: MatchOptions): R;
     /** The stub received exactly `n` calls matching `method path`. */
     toHaveReceivedTimes(n: number, method?: string, path?: string | RegExp, match?: MatchOptions): R;
+    /**
+     * On the scenario's `stub` accessor: the calls happened in this order, across stubs (other calls
+     * may come in between): `expect(stub).toHaveReceivedInOrder([["stripe", "POST", "/v1/charges"], ["mail", "POST", "/send"]])`.
+     */
+    toHaveReceivedInOrder(calls: OrderedCall[]): R;
     /** The stub received a GraphQL request for `operation` (with `variables` as a subset, if given). */
     toHaveReceivedGraphQL(operation: string | RegExp, variables?: unknown): R;
     /** A GraphQL response without `errors`, whose `data` contains `expected` (if given). The failure message shows the errors. */
@@ -15,8 +22,16 @@ interface SlicetestMatchers<R = unknown> {
      * relative to the working directory with an optional pointer, `openapi.yaml#/components/schemas/Poll`.
      */
     toMatchSchema(schema: object | string): R;
-    /** The response has this status; the failure message shows the response body. */
-    toHaveStatus(status: number): R;
+    /** The response has this status, a status of this class (`"2xx"`) or one of a list (`[200, 204]`); the failure message shows the response body. */
+    toHaveStatus(status: number | `${1 | 2 | 3 | 4 | 5}xx` | (number | `${1 | 2 | 3 | 4 | 5}xx`)[]): R;
+    /**
+     * The response sets cookie `name`, with these attributes as a subset (`value`, `httpOnly`,
+     * `secure`, `sameSite`, `path`, `domain`, `maxAge`, `expires`, `partitioned`):
+     * `expect(res).toSetCookie("sid", { httpOnly: true, secure: true, sameSite: "Lax" })`.
+     */
+    toSetCookie(name: string, attributes?: Record<string, unknown>): R;
+    /** The response arrived within `ms` milliseconds (measured from sending the request to reading the whole body). */
+    toRespondWithin(ms: number): R;
     /** An array of responses has exactly these status counts, e.g. `{ 201: 1, 409: 9 }`. */
     toHaveStatuses(counts: Record<number, number>): R;
     /** Async: the table has at least one row matching `where` (`count` for an exact number). */
@@ -26,5 +41,8 @@ declare module "vitest" {
     interface Matchers<R extends void | Promise<void> = void | Promise<void>, T = unknown> extends SlicetestMatchers<R> {
     }
 }
+/** A status code, a class (`"2xx"`), or a list of either: `[200, 204]`, `["2xx", 304]`. */
+export type ExpectedStatus = number | string | (number | string)[];
+export declare function statusMatches(expected: ExpectedStatus, actual: number): boolean;
 export declare function statusCounts(responses: HttpResponse[]): Record<number, number>;
 export {};

package/dist/matchers.js

@@ -1,8 +1,10 @@
 import { expect } from "vitest";
 import { Db } from "./db.js";
+import { setCookies } from "./http.js";
 import { describeGraphQL } from "./graphql.js";
 import { schemaProblems } from "./schema.js";
 import { Stub, subset } from "./stub.js";
+import { timeline } from "./timeline.js";
 const MAX_SHOWN = 5;
 function describeCalls(calls) {
     if (calls.length === 0)
@@ -21,6 +23,24 @@ function assertStub(received) {
     if (!(received instanceof Stub))
         throw new TypeError("slicetest: expected a stub, e.g. expect(stub(\"slack\"))");
 }
+export function statusMatches(expected, actual) {
+    if (Array.isArray(expected)) {
+        if (expected.length === 0)
+            throw new TypeError("slicetest: toHaveStatus needs at least one status in the list");
+        return expected.some((e) => statusMatches(e, actual));
+    }
+    if (typeof expected === "number")
+        return expected === actual;
+    const s = String(expected).trim().toLowerCase();
+    if (/^\d{3}$/.test(s))
+        return Number(s) === actual;
+    if (/^[1-5]xx$/.test(s))
+        return Math.floor(actual / 100) === Number(s[0]);
+    throw new TypeError(`slicetest: a status is a code (201), a class ("2xx") or a list of them, got ${JSON.stringify(expected)}`);
+}
+function describeStatus(expected) {
+    return Array.isArray(expected) ? `one of ${expected.join(", ")}` : String(expected);
+}
 export function statusCounts(responses) {
     const out = {};
     for (const r of responses)
@@ -63,6 +83,39 @@ expect.extend({
             expected: n,
         };
     },
+    toHaveReceivedInOrder(received, expected) {
+        if (typeof received !== "function")
+            throw new TypeError("slicetest: toHaveReceivedInOrder takes the scenario's stub accessor: expect(stub).toHaveReceivedInOrder([...])");
+        const stubOf = received;
+        const startOf = (c) => timeline.get(c)?.start ?? 0;
+        let after = -Infinity;
+        let failedAt = -1;
+        for (const [i, [name, method, path, match]] of expected.entries()) {
+            const next = stubOf(name)
+                .calls(method, path, match)
+                .map(startOf)
+                .filter((t) => t > after)
+                .sort((a, b) => a - b)[0];
+            if (next === undefined) {
+                failedAt = i;
+                break;
+            }
+            after = next;
+        }
+        const names = [...new Set(expected.map(([n]) => n))];
+        const all = names
+            .flatMap((n) => stubOf(n).calls().map((c) => ({ n, c })))
+            .sort((a, b) => startOf(a.c) - startOf(b.c))
+            .map(({ n, c }) => `  ${n}: ${c.graphql ? describeGraphQL(c.graphql) : `${c.method} ${c.path}`}`);
+        const label = ([n, m, p, match]) => `${n}: ${m} ${p}${match && Object.keys(match).length ? ` with ${JSON.stringify(match, (_, v) => (v instanceof RegExp ? String(v) : v))}` : ""}`;
+        return {
+            pass: failedAt === -1,
+            message: () => failedAt === -1
+                ? `expected the stubs not to receive, in this order:\n${expected.map((e) => `  ${label(e)}`).join("\n")}`
+                : `expected the stubs to receive, in this order:\n${expected.map((e, i) => `  ${i === failedAt ? "✗" : i < failedAt ? "✓" : " "} ${label(e)}`).join("\n")}\n` +
+                    `${failedAt === 0 ? "the first call never came" : `no matching call came after #${failedAt}`}. Calls received, in order:\n${all.join("\n") || "  (no calls)"}`,
+        };
+    },
     toHaveReceivedGraphQL(received, operation, variables) {
         assertStub(received);
         const pass = received.calls("*", undefined, { graphql: { operation, variables } }).length > 0;
@@ -106,18 +159,54 @@ expect.extend({
         };
     },
     toHaveStatus(received, status) {
-        const pass = received?.status === status;
+        if (!received || typeof received !== "object" || typeof received.status !== "number") {
+            throw new TypeError(`slicetest: toHaveStatus expects a response from http, got ${this.utils.stringify(received)}`);
+        }
+        const pass = statusMatches(status, received.status);
         return {
             pass,
             message: () => {
                 const body = received.text.length > 1000 ? `${received.text.slice(0, 1000)}…` : received.text;
-                return (`expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to respond ${status}, got ${received.status}\n` +
+                return (`expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to respond ${describeStatus(status)}, got ${received.status}\n` +
                     `Response body:\n  ${body || "(empty)"}`);
             },
             actual: received?.status,
             expected: status,
         };
     },
+    toSetCookie(received, name, attributes = {}) {
+        if (!received || typeof received !== "object" || !(received.headers instanceof Headers)) {
+            throw new TypeError(`slicetest: toSetCookie expects a response from http, got ${this.utils.stringify(received)}`);
+        }
+        const cookies = setCookies(received);
+        const cookie = Object.hasOwn(cookies, name) ? cookies[name] : undefined;
+        // SameSite values are case-insensitive: "Lax" and "lax" are the same attribute. A matcher sees the value as sent.
+        const plain = typeof attributes.sameSite === "string";
+        const want = plain ? { ...attributes, sameSite: attributes.sameSite.toLowerCase() } : attributes;
+        const pass = !!cookie && subset(want, plain ? { ...cookie, sameSite: cookie.sameSite?.toLowerCase() } : cookie);
+        const describe = (c) => `${c.name}=${c.value.length > 40 ? `${c.value.slice(0, 40)}…` : c.value} ${JSON.stringify(Object.fromEntries(Object.entries(c).filter(([k, v]) => k !== "name" && k !== "value" && v !== undefined && v !== false)))}`;
+        return {
+            pass,
+            message: () => {
+                const head = `expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to set cookie ${name}${Object.keys(attributes).length ? ` with ${this.utils.stringify(attributes, 10, { min: true })}` : ""}`;
+                const all = Object.values(cookies);
+                return `${head}\n${all.length ? `Cookies it set:\n${all.map((c) => `  ${describe(c)}`).join("\n")}` : "It set no cookies."}`;
+            },
+        };
+    },
+    toRespondWithin(received, ms) {
+        if (!received || typeof received !== "object" || typeof received.durationMs !== "number") {
+            throw new TypeError(`slicetest: toRespondWithin expects a response from http, got ${this.utils.stringify(received)}`);
+        }
+        if (!(typeof ms === "number" && ms > 0))
+            throw new TypeError(`slicetest: toRespondWithin needs a positive number of milliseconds, got ${this.utils.stringify(ms)}`);
+        return {
+            pass: received.durationMs <= ms,
+            message: () => `expected ${received.method} ${received.url} ${this.isNot ? "not " : ""}to respond within ${ms}ms, it took ${received.durationMs}ms`,
+            actual: received.durationMs,
+            expected: ms,
+        };
+    },
     toHaveStatuses(received, counts) {
         if (!Array.isArray(received))
             throw new TypeError("slicetest: toHaveStatuses expects an array of responses, e.g. from http.concurrently()");

package/dist/openapi.d.ts

@@ -31,11 +31,6 @@ export interface Message {
     body: unknown;
     query?: URLSearchParams;
 }
-/**
- * An OpenAPI 3.0 / 3.1 document, used to check that real traffic matches it:
- * the app's responses against the app's own spec, and the app's calls to a
- * stubbed service (and the stub's canned replies) against that service's spec.
- */
 export declare class OpenApiSpec {
     #private;
     readonly file: string;

package/dist/openapi.js

@@ -5,11 +5,17 @@ import addFormatsModule from "ajv-formats";
 import { parse } from "yaml";
 const addFormats = (addFormatsModule.default ?? addFormatsModule);
 const METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
-/**
- * An OpenAPI 3.0 / 3.1 document, used to check that real traffic matches it:
- * the app's responses against the app's own spec, and the app's calls to a
- * stubbed service (and the stub's canned replies) against that service's spec.
- */
+/** A server's URL with its `{variables}` filled in: every `enum` value, else the default. */
+function serverUrls(server) {
+    let urls = [server.url ?? "/"];
+    for (const [name, v] of Object.entries(server.variables ?? {})) {
+        const values = [...new Set([...(v.default === undefined ? [] : [v.default]), ...(v.enum ?? [])].map(String))];
+        if (values.length === 0 || !urls[0].includes(`{${name}}`))
+            continue;
+        urls = urls.flatMap((u) => values.map((value) => u.replaceAll(`{${name}}`, value))).slice(0, 50);
+    }
+    return urls;
+}
 export class OpenApiSpec {
     file;
     doc;
@@ -45,7 +51,8 @@ export class OpenApiSpec {
         // Paths in the spec are relative to the server URL, e.g. /v1 for https://api.example.com/v1.
         this.#basePaths = [
             ...new Set((doc.servers ?? [])
-                .map((s) => new URL(s.url ?? "/", "http://x").pathname.replace(/\/$/, ""))
+                .flatMap((s) => serverUrls(s))
+                .map((url) => new URL(url, "http://x").pathname.replace(/\/$/, ""))
                 .filter(Boolean)),
         ];
     }

package/dist/record.d.ts

@@ -1,6 +1,6 @@
 import type { Changes } from "./db.js";
 import type { ScenarioContext } from "./runtime.js";
-import type { RecordedCall } from "./stub.js";
+import { type RecordedCall } from "./stub.js";
 /**
  * `npx slicetest record`: use the app for real (a browser, curl, a mobile
  * client) through a proxy, and get the session back as a YAML scenario: the

package/dist/record.js

@@ -3,6 +3,7 @@ import { writeFile } from "node:fs/promises";
 import http from "node:http";
 import path from "node:path";
 import { stringify } from "yaml";
+import { parseForm } from "./stub.js";
 import { mask } from "./trace.js";
 export const SESSION_ENV = "SLICETEST_RECORD_SESSION";
 /** Requests a browser makes on its own, not part of what the scenario is about. */
@@ -113,8 +114,9 @@ export function buildScenario(exchanges, calls, changes, { name = "recorded sess
         if (x.body) {
             if (/json/i.test(x.contentType ?? ""))
                 step.json = parse(reqBody, "application/json");
+            // Nested and repeated fields survive: `form:` is encoded back the same way on replay.
             else if (/x-www-form-urlencoded/i.test(x.contentType ?? ""))
-                step.form = Object.fromEntries(new URLSearchParams(reqBody));
+                step.form = parseForm(reqBody);
             else
                 step.body = reqBody;
         }

package/dist/recording.d.ts

@@ -38,6 +38,13 @@ export declare class Recorder {
     /** Recordings made by this worker, to be merged into the file when the run ends. */
     added(): Recording[];
 }
+export declare const REDACTED = "[redacted]";
+/**
+ * A request with credential values replaced by `[redacted]`, so recordings can be committed and
+ * replay whatever key the test environment uses. Applied to recordings and to calls alike before
+ * they are compared.
+ */
+export declare function redactRequest(r: Recording["request"]): Recording["request"];
 export declare function readRecordings(file: string): Promise<Recording[]>;
 /** Append new recordings to `file`, skipping exact duplicates, keeping the order they were made in. */
 export declare function mergeRecordings(file: string, upstream: string, added: Recording[], source?: string): Promise<void>;

package/dist/recording.js

@@ -90,14 +90,48 @@ export class Recorder {
 }
 function requestOf(call) {
     const query = Object.fromEntries([...call.query.entries()].sort(([a], [b]) => a.localeCompare(b)));
-    return {
+    return redactRequest({
         method: call.method,
         path: call.path,
         ...(Object.keys(query).length ? { query } : {}),
         ...(call.json !== undefined ? { json: call.json } : call.body ? { body: call.body } : {}),
-    };
+    });
 }
-function keyOf(r) {
+/** Credentials sent in a query, a form or JSON body: `api_key`, `key`, `access_token`, `client_secret`, `password`, `appid`, signatures. */
+const SECRET = /^(api[-_]?key|apikey|key|(access|refresh|id|auth)[-_]?token|token|client[-_]?secret|app[-_]?secret|secret|password|passwd|appid|signature|sig|x-amz-(signature|credential|security-token))$/i;
+/** In bodies, a bare `key` is usually data (a KV store's key, a record's key) that tells requests apart, not a credential. */
+const bodySecret = (k) => SECRET.test(k) && k.toLowerCase() !== "key";
+export const REDACTED = "[redacted]";
+const FORM_BODY = /^[^\s=&]+=[^\s&]*(&[^\s=&]+=[^\s&]*)*$/;
+/**
+ * A request with credential values replaced by `[redacted]`, so recordings can be committed and
+ * replay whatever key the test environment uses. Applied to recordings and to calls alike before
+ * they are compared.
+ */
+export function redactRequest(r) {
+    const out = { ...r };
+    if (r.query)
+        out.query = Object.fromEntries(Object.entries(r.query).map(([k, v]) => [k, SECRET.test(k) ? REDACTED : v]));
+    if (r.json !== undefined)
+        out.json = redactJson(r.json);
+    if (r.body && FORM_BODY.test(r.body)) {
+        const form = new URLSearchParams(r.body);
+        if ([...form.keys()].some(bodySecret)) {
+            out.body = [...form].map(([k, v]) => `${encodeURIComponent(k)}=${bodySecret(k) ? REDACTED : encodeURIComponent(v)}`).join("&");
+        }
+    }
+    return out;
+}
+function redactJson(v) {
+    if (Array.isArray(v))
+        return v.map(redactJson);
+    if (v && typeof v === "object")
+        return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, typeof x === "string" && bodySecret(k) ? REDACTED : redactJson(x)]));
+    return v;
+}
+function keyOf(request) {
+    // Recordings made before redaction still match: both sides are compared redacted.
+    const r = redactRequest(request);
     return JSON.stringify([r.method.toUpperCase(), r.path, sortKeys(r.query ?? {}), sortKeys(r.json ?? null), r.body ?? ""]);
 }
 function sortKeys(v) {
@@ -143,6 +177,6 @@ export async function mergeRecordings(file, upstream, added, source = `Recorded
         if (!entries.some((x) => isDeepStrictEqual(x, e)))
             entries.push(e);
     await mkdir(path.dirname(file), { recursive: true });
-    const header = `# ${source}. Review before committing: request bodies are stored as sent.\n`;
+    const header = `# ${source}. Review before committing: credentials in queries and bodies (api_key, access_token, client_secret, password, …) are replaced by ${REDACTED}, but other values are stored as sent.\n`;
     await writeFile(file, header + YAML.stringify(entries, { lineWidth: 0 }));
 }

package/dist/runtime.js

@@ -124,6 +124,7 @@ export class Runtime {
                 ? await Db.connect(await engine.driver(url), url, {
                     schemas: opts.db.schemas,
                     keep: opts.db.keep,
+                    ignoreChanges: opts.db.ignoreChanges,
                     seedFile: opts.db.seed && path.resolve(opts.root, opts.db.seed),
                 })
                 : noDatabase();
@@ -301,6 +302,9 @@ export class Runtime {
         this.#assertAlive();
         if (this.interceptor?.blocked.size)
             throw new Error(blockedHint([...this.interceptor.blocked]));
+        const thrown = this.#handlerErrors();
+        if (thrown.length > 0)
+            throw new Error(`slicetest: a stub's reply threw, so the app got an error response instead of the reply:\n${thrown.join("\n")}`);
         const unmatched = this.#unmatched();
         if (unmatched.length > 0) {
             throw new Error(`slicetest: the app called stubbed services with no matching route:\n${unmatched.join("\n")}`);
@@ -346,6 +350,12 @@ export class Runtime {
         }
         return out;
     }
+    #handlerErrors() {
+        return [...this.stubs.values()].flatMap((s) => s.handlerErrors().map(({ call, error }) => {
+            const where = error?.stack?.split("\n").find((l) => /^\s+at /.test(l) && !l.includes("node_modules") && !l.includes("node:"))?.trim();
+            return `  ${s.name}: ${call.method} ${call.path}: ${error instanceof Error ? error.message : String(error)}${where ? `\n    ${where}` : ""}`;
+        }));
+    }
     #unmatched() {
         return [...this.stubs.values()].flatMap((s) => {
             const calls = s.unmatched();
@@ -400,6 +410,9 @@ export class Runtime {
             if (exit)
                 sections.push(`the ${p.label} exited (code ${exit.code}, signal ${exit.signal}); it will be restarted for the next scenario`);
         }
+        const thrown = this.#handlerErrors();
+        if (thrown.length > 0)
+            sections.push(`stub replies that threw:\n${thrown.join("\n")}`);
         const unmatched = this.#unmatched();
         if (unmatched.length > 0)
             sections.push(`stub calls with no matching route:\n${unmatched.join("\n")}`);

package/dist/scenario.d.ts

@@ -1,15 +1,25 @@
 import type { Runtime, ScenarioContext } from "./runtime.js";
 export declare function setRuntime(runtime: Runtime | undefined): void;
 type Body = (ctx: ScenarioContext) => Promise<void> | void;
+export interface ScenarioOptions {
+    timeout?: number;
+    /** Labels to select scenarios by: `npx slicetest --tag smoke`, or `SLICETEST_TAGS=smoke,!slow` with Vitest. */
+    tags?: string[];
+}
+/**
+ * Whether a scenario with `tags` runs under `filter` (`SLICETEST_TAGS`): comma- or space-separated tags,
+ * any of which it must have, and `!tag`s it must not have. No filter runs everything.
+ */
+export declare function tagsSelected(tags?: readonly string[], filter?: string | undefined): boolean;
 /**
  * A test that runs against the real app. The database is reset to the
  * migrated schema (plus seed) and stubs are cleared before each scenario.
  */
-export declare const scenario: ((name: string, body: Body, timeout?: number) => void) & {
-    only: (name: string, body: Body, timeout?: number) => void;
-    skip: (name: string, body: Body, timeout?: number) => void;
+export declare const scenario: ((name: string, body: Body, options?: number | ScenarioOptions) => void) & {
+    only: (name: string, body: Body, options?: number | ScenarioOptions) => void;
+    skip: (name: string, body: Body, options?: number | ScenarioOptions) => void;
     todo: (name: string) => void;
     /** Same scenario for each row: `scenario.each(rows)("name %s", async (row, ctx) => ...)`. */
-    each<T>(rows: readonly T[]): (name: string, body: (row: T, ctx: ScenarioContext) => Promise<void> | void, timeout?: number) => void;
+    each<T>(rows: readonly T[]): (name: string, body: (row: T, ctx: ScenarioContext) => Promise<void> | void, options?: number | ScenarioOptions) => void;
 };
 export {};